# CVEs published 2017-04-26

11 CVEs were published on April 26, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-3161](https://cve.now/CVE-2017-3161.md): The HDFS web UI in Apache Hadoop before 2.7.0 is vulnerable to a cross-site scripting (XSS) attack through an unescaped query parameter. (no CVSS, Apache Software Foundation Apache Hadoop · org.apache.hadoo…)
- [CVE-2017-3162](https://cve.now/CVE-2017-3162.md): HDFS clients interact with a servlet on the DataNode to browse the HDFS namespace. (no CVSS, Apache Software Foundation Apache Hadoop · org.apache.hadoo…)
- [CVE-2016-8924](https://cve.now/CVE-2016-8924.md): IBM Maximo Asset Management 7.1, 7.5 and 7.6 could allow a remote attacker to hijack a user's session, caused by the failure to invalidate a (no CVSS, IBM Maximo Asset Management)
- [CVE-2016-8962](https://cve.now/CVE-2016-8962.md): IBM BigFix Inventory 9.2 does not require that users should have strong passwords by default, which makes it easier for attackers to comprom (no CVSS, IBM BigFix Inventory)
- [CVE-2017-1170](https://cve.now/CVE-2017-1170.md): IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 8.0 could allow a local user to hijack a user's session. (no CVSS, IBM WebSphere Commerce Enterprise)
- [CVE-2017-6052](https://cve.now/CVE-2017-6052.md): A Man-in-the-Middle issue was discovered in Hyundai Motor America Blue Link 3.9.5 and 3.9.4. (no CVSS, Hyundai Motor America Blue Link)
- [CVE-2017-6054](https://cve.now/CVE-2017-6054.md): A Use of Hard-Coded Cryptographic Key issue was discovered in Hyundai Motor America Blue Link 3.9.5 and 3.9.4. (no CVSS, Hyundai Motor America Blue Link)
- [CVE-2017-7720](https://cve.now/CVE-2017-7720.md): Buffer overflow in PrivateTunnel 2.7 and 2.8 allows local attackers to cause a denial of service (SEH overwrite) or possibly have unspecifie (no CVSS)
- [CVE-2017-8284](https://cve.now/CVE-2017-8284.md): The disas\_insn function in target/i386/translate.c in QEMU before 2.9.0, when TCG mode without hardware acceleration is used, does not limit (no CVSS)
- [CVE-2017-7293](https://cve.now/CVE-2017-7293.md): The Dolby DAX2 and DAX3 API services are vulnerable to a privilege escalation vulnerability that allows a normal user to get arbitrary syste (no CVSS)
- [CVE-2017-8283](https://cve.now/CVE-2017-8283.md): dpkg-source in dpkg 1.3.0 through 1.18.23 is able to use a non-GNU patch program and does not offer a protection mechanism for blank-indente (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-04-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.